This is a brief whitepaper called False SQL Injection and Advanced Blind SQL Injection. This document is written for publicizing of new SQL injection method about detour some web firewall or some security solution.

In order to read this document, you have to understand basic MySQL principles. I classified the term "SQL Injection" as 2 meanings. The first is a general SQL Injection, we usually call this "True SQL Injection", and the second is a "False SQL Injection". Though in this documentation, you can know something special about "True SQL Injection"



And I mean to say it's true that my method (False SQL Injection) is different from True/False SQL Injection mentioned in "Blind SQL Injection". A tested environment was as follow.


ubuntu server  11.04
mysql    5.1.54-1
Apache    2.2.17
PHP    5.3.5-1

A tested code was as follow.

/*
create database injection_db;
use injection_db;
create table users(num int not null, id varchar(30) not null, password varchar(30) not null, primary key(num));

insert into users values(1, 'admin', 'ad1234');
insert into users values(2, 'anutiger', 'at1234');
insert into users values(3, 'pctipsbyanu', 'pc1234');

*** login.php ***
*/

if(empty($_GET['id']) || empty($_GET['password'])){
  echo "";
  echo "";
  echo "

";
  echo "

ID     
";
  echo "PASS

";
  echo "";
  echo "

";
  echo "";
  echo "";
}

else{
  $id = $_GET['id'];
  $password = $_GET['password'];

  $dbhost = 'localhost';
  $dbuser = 'root';
  $dbpass = 'pass';
  $database = 'injection_db';

  $db = mysql_connect($dbhost, $dbuser, $dbpass);
  mysql_select_db($database,$db);
  $sql = mysql_query("select * from users where id='$id' and password='$password'") or die (mysql_error());

 Thnks...